Privacy Policy

Harbor Escape · Effective date: 2026-10-01 · Last updated: 2026-10-07

Harbor Escape (the "game") is a free casual puzzle game played in a web browser at https://play.harb.fun. It is operated by the Harbor Escape team ("we", "us"). This policy explains what data the game collects, why, how long we keep it, who else receives it, and how you can have it deleted. It covers the game, the pages on this website and our game server.

1. Information we collect

We do not ask for your name, phone number, postal address, precise location, photos, contacts or payment details. The game has no chat; the only text you can send us is the optional in-game feedback form, where you may also leave an email address if you want a reply (section 1.4). Account names the platform itself gives the game (Telegram or CrazyGames) are covered in section 1.2.

1.1 Information stored in your browser

The game uses your browser's local storage (not cookies) for the following. This data stays on your device unless it is listed in section 1.2 as sent to our server.

Item	What it is
Device ID	A random identifier (UUID) created the first time you open the game. It contains no information about you or your device.
Player ID and session token	The anonymous player ID our server assigns to you, and a signed token that lets the game talk to our server (valid for 30 days, then renewed automatically).
Game progress	Levels cleared and stars earned, harbor repairs, settings (such as sound) and which tutorials and tips you have seen.
Offline queue	Game data that could not be sent yet (for example while you are offline); it is sent and removed when you are back online.
Level pack	A cached copy of the latest levels downloaded from our server.
Sign-in status	Whether you chose Google sign-in or to play as a guest, and whether your progress is linked to a Google account.
Your email address (only if you sign in with Google)	Read on your device from the sign-in response so that the Settings screen can show, partly masked, which account is linked. It is kept only in your browser and is never sent to or stored on our server.
Language	The language you use in the game, so that these web pages can be shown in the same language.

You can delete all of this at any time by clearing this site's data in your browser settings. If your progress is not saved to the cloud, clearing it also deletes your progress.

1.2 Information stored on our server

Data	Details and purpose
Anonymous player and device records	Your player ID, your device ID, the platform ("web") and when they were created and last used. Used to recognise your browser and keep your saved progress.
Saved game (cloud save)	The same game progress described in 1.1 (levels, stars, harbor repairs, settings, tutorial flags), plus a revision number. Used to back up your progress and restore it on another device.
Level completion records	For each level you complete: the level number, stars, time taken, number of hints used and the completion time. Used for level statistics.
Gameplay events	Short records of what happens in the game, described in section 1.3. Used to find levels that are too hard or too easy, and to detect errors.
Rewarded ad records	When you finish watching a rewarded ad: a random transaction ID created by the game, the reward type ("continue"), where in the game the ad was shown, and the time. Used so that each reward is granted exactly once. It does not contain any information from Google's ad systems.
Recovery codes	If you ask for one in Settings, an 8-character code linked to your player ID, used to move your progress to another device. It expires after 24 hours.
Google account link (optional)	Only if you sign in with Google: the Google account ID ("subject" identifier), linked to your player ID, with the time it was linked and last used. See section 2.
Purchases with Telegram Stars (Telegram version only)	If you buy an item in the Telegram version: your Telegram user ID, the item, the number of Stars, the payment identifiers Telegram gives us (a "charge ID"), the time, whether the purchase was refunded, and what it gave your player (boosters and permanent items such as ad removal) and whether the game has received them. Used to deliver your items exactly once, restore them on another device, handle refunds and support requests, and for our accounts. Payment itself is handled by Telegram; we never see or store card or bank details.
Daily challenge leaderboard and friends	For each daily challenge you play: how many attempts you started, and for your first clear the attempt number, stars, berths used, time, number of moves, mistakes and boosters, and whether you used a continue. Friends: the link between two players when one opened the other's invite or daily-challenge link (or was invited), and whether either of you removed it. In the Telegram version only, and only when you play the daily challenge or open the leaderboard: your Telegram first name, read from the data Telegram gives the game, shortened to 24 characters. Used to rank the day's results among your friends and on the global top 50. Friends see your first name; on the global board you appear as "Captain #" and a number unless you turn on "Show my name" on the leaderboard. Other players never see your player ID or Telegram ID. You can remove a friend at any time on the leaderboard.
Telegram bot reminders (optional, Telegram version only)	Only if you turn reminders on (in the game after a daily challenge, in Settings, or by sending /reminders on to our bot): your Telegram user ID (which is also the chat the bot writes to), whether reminders are on, how you turned them on and, if you turned them off, how (Settings, /reminders off, the button, or blocking the bot); the language of the messages; your time zone offset (for example UTC+3, read from your device) and the hour you were playing when you turned reminders on; your daily-challenge streak and the last day you finished it; when you last opened the game and how many reminders since then went without a visit. For each day a reminder is sent: its type (new daily challenge / streak about to end), the time, and whether Telegram accepted it. We do not store the text of the messages or anything you write to the bot. Used to send at most one short message a day, never between 22:00 and 08:00 your time (until the game has told us your time zone, only between 10:00 and 18:00 UTC), and to stop by themselves after three reminders without a visit. Turn reminders off at any time in Settings, by sending /reminders off, or with the "Turn off reminders" button under each message; if you block the bot, we stop too.
Channel reward (optional, Telegram version only)	Only when you claim the reward for joining our Telegram channel @harborescape_game: we ask Telegram whether your Telegram account is a member of the channel and keep only the answer for that moment (member or not; never your name or anything else Telegram knows about you), and we record that your Telegram user ID has received the reward, which boosters it gave and when, so the reward is given once per Telegram account. The record is deleted together with your player record.
How you found the game	Recorded once, when your player record is first created: the kind of link or page that brought you (for example a link we posted in our Telegram channel, on a video site or on a forum, a friend's invite or daily-challenge link, or opening the game directly), the short label and campaign name in that link, the invite code it carried, and the domain name of the website you came from (for example "www.reddit.com", never the full address). Used only to see which of our promotion channels bring players who enjoy the game. It is never changed afterwards and is deleted together with your player record.
Device and browser information	Sent with each game-session start (section 1.3): the operating-system family, browser family and device class (phone, tablet or computer), the screen size, the browser language and the time zone your device reported, and your country as determined from your IP address by our CDN (Cloudflare). Your IP address itself is not stored and we do not build a device fingerprint. Used to understand what devices players use and to troubleshoot display problems.
Platform account name	When you play in Telegram: the name, username and language Telegram gives the game; when you sign in with a CrazyGames account: your CrazyGames username. Shown only in our private back office and used for support and to recognise accounts; never shown publicly and never shared with third parties.
Server request logs	For each request to our game server: time, IP address, browser user agent, the address requested, the response status and your player ID. Used for rate limiting (blocking abuse), security and troubleshooting.
Feedback you send (optional)	What you write in the in-game feedback form and the details listed in section 1.4. Used to read and answer your feedback and to improve the game.

1.3 Gameplay events

Each event contains its name, the details listed below, your anonymous player ID, a random event ID, the time it happened on your device and the time our server received it. Events never contain your name, email address or any Google data.

Event	Details sent
Game session started	Platform, game version, whether this is the first launch, interface language, layout (portrait / landscape), and the device and browser information listed in section 1.2 (operating-system family, browser family, device class, screen size and pixel ratio, browser language, time zone, whether the screen is a touch screen, the Telegram app type and version when played in Telegram, and the country our CDN determined)
Level started, completed, failed or quit	Level number; for completed levels the stars, time taken, hints used, wrong taps and boats hit by bombs; for failed or quit levels the number of boats left, time taken and whether the "continue" option was used
Hint used	Level number and which boat was highlighted
Bomb boat exploded	Level number and how many boats were hit
Rewarded ad shown, reward granted, or ad not completed	Where the ad was offered; the random transaction ID when a reward is granted; the reason (for example "cancelled" or "not available") when it was not completed
Harbor repair	Which part of the harbor was repaired, its price in stars and the stars left
Tutorial finished	No details
Save conflict or save reset	How many levels the local and cloud saves had and which one was kept; or the reason a damaged local save was reset
Sign-in screen shown, played as guest, Google sign-in succeeded or failed	Whether the screen was shown at launch or from Settings; the result (new link, already linked, or switched to an existing account); or an error code
Level pack update	The result (applied, cached, invalid, failed or skipped), the level pack version and number of levels

1.4 In-game feedback and AI analysis

Sending feedback is optional (Settings → Feedback). When you send it, our server stores:

• the category you chose (bug, suggestion, difficulty, ads or other) and your message (up to 1,000 characters);
• your email address, only if you enter one because you want a reply;
• the level number (the level you are playing, or the last or highest one you reached), the game version, the game language and the platform ("web");
• your browser's user agent string (browser and operating system, at most 300 characters), the time, a random feedback ID and your anonymous player ID.

We use it to read and answer your feedback, find and fix problems, and decide what to improve. Only the Harbor Escape team can see it, in our private back office. Your email address is used only to reply to that feedback; it is never sent to the AI service below or included in statistics. One player can send at most 5 feedback messages per hour. Please do not include personal or sensitive information (for example your full name, address, phone number, passwords, or health or financial details) in your message.

AI analysis. Once a day, and sometimes on demand, our server sends new feedback to the API of DeepSeek, an AI service operated by a company in the People's Republic of China, to classify it (category, severity, mood, a one-line summary, keywords, likely duplicates) and to write a short internal report for the team. What is sent: the category, the message text, the level number, game version, language, platform and submission time. Before sending, our server automatically removes email addresses, phone-like numbers, links and IDs from the text, and replaces your player ID with a temporary number that is only valid for that batch; your email address, user agent, IP address and player ID are never sent. The report also uses aggregate gameplay statistics (for example how many players failed a level), which contain no personal information. The results are stored on our server with your feedback and used only to improve the game. We do not use your feedback to train AI models, and we do not use AI to make decisions about you.

DeepSeek processes the data it receives under its own Open Platform Terms and Privacy Policy. As of 2026-10-01 its privacy policy (last updated 2026-02-10) says that it stores data in the People's Republic of China and that it may use the content it receives to train and improve its models, with a right to opt out on request; its API terms do not promise that API inputs are excluded from this. This is why we remove contact details before sending and ask you not to write personal information in feedback.

2. Google user data (Sign in with Google)

Signing in with Google is optional. Its only purpose is to save your game progress and restore it when you sign in on another device. You can always play without signing in, and you can still move your progress with a recovery code instead.

2.1 What we request and access

• Scopes. We use Google Identity Services ("Sign in with Google") with only the basic sign-in scopes: openid, together with the basic profile and email information that Google's sign-in button includes by default (email, profile). We do not request any other scope and have no access to Gmail, Google Drive, Contacts, Calendar, Photos or any other Google service.
• What we receive. When you sign in, Google gives the game an ID token: a signed message that contains your Google account ID and, as part of the basic scopes, your email address, name and profile picture link.
• What our server does with it. The game sends the ID token to our server once. The server checks Google's signature and that the token was issued for Harbor Escape, then reads only the Google account ID ("sub"). The token itself is not stored or logged.

2.2 What we store

• We store only your Google account ID, linked to your anonymous player ID, plus the time it was linked and last used.
• We do not store your email address, name or profile picture on our server.
• Your email address may be shown, partly masked, in the game's Settings on your own device so you can see which account is linked. It is kept only in your browser's local storage and is removed when you clear the site's data or the link changes.

2.3 How we use it

• Only to link your game progress to your Google account and restore that progress when you sign in again, on this or another device.
• We do not use Google user data for advertising, to build profiles, or to develop, improve or train artificial intelligence or machine learning models.
• Harbor Escape does not use any Google API to generate, edit or analyze images, and does not use AI to create images of people.

2.4 Sharing

We do not sell, rent, share or transfer Google user data to anyone, including advertisers and data brokers. The only exceptions are the ones the Limited Use requirements allow: where required by law, or as part of a merger or acquisition of the game, and in each case only with your Google data protected as described here.

2.5 Unlinking and deletion

• To unlink your Google account or delete your data, email us as described in section 10. We remove the link (and, if you ask, all your data) within 30 days.
• You can also remove Harbor Escape's access at any time at myaccount.google.com/connections. This stops future sign-ins; email us if you also want the stored link deleted.

Harbor Escape's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we use information

• To run the game, save your progress and restore it on another device.
• To grant rewards from rewarded ads exactly once.
• To produce aggregate statistics (for example, how many players finish a level and how long it takes) so we can balance the levels and fix problems.
• To keep the service secure and prevent abuse, for example by limiting how many requests one IP address can send.
• To read and answer feedback you send us and to improve the game, including the AI analysis described in section 1.4.
• In the Telegram version, to send the daily-challenge reminders you asked for (section 1.2).
• In the Telegram version, when you claim the channel reward, to check that you joined our channel and to give the reward only once (section 1.2).

We do not sell personal information, we do not use it to identify you, and we do not use it for targeted advertising.

4. Advertising

Harbor Escape is free and supported by ads. The game uses Google's ad service for web games (Ad Placement API for H5 games, part of Google AdSense) to offer rewarded ads: an ad plays only if you choose to watch one, for example to refill your hearts and continue a level. Google's ad script is loaded when you open the game.

Google and its partners may use cookies, device identifiers and similar technologies to show ads, measure them, prevent fraud and, depending on your settings and location, personalise ads. Google processes this data under its own policies; we do not receive it, and we do not share your game data or Google account link with advertisers. Learn more:

• How Google uses information from sites or apps that use its services
• How Google uses cookies in advertising
• Google ad settings (turn off personalised ads)

5. Cookies and similar technologies

The game itself does not set cookies; it uses local storage as described in section 1.1. Google may set cookies for ads (section 4) and for Sign in with Google if you use it. Our hosting provider, Cloudflare, may set strictly necessary security cookies and may provide us with cookie-free, aggregate visitor statistics (such as page views and load times).

6. Service providers and sharing

We share data only with providers that help us run the game, and only as needed:

• Cloudflare hosts this website and carries all traffic to our game server. It processes connection data such as your IP address to deliver and protect the service (Cloudflare privacy policy).
• Google provides Sign in with Google (if you use it) and the ads (Google Privacy Policy).
• DeepSeek (AI service, People's Republic of China) receives the text of feedback you send, with contact details removed, for classification and summaries, as described in section 1.4 (DeepSeek Privacy Policy).
• Telegram runs the Telegram version of the game (as a Mini App) and processes purchases made with Telegram Stars. We receive your Telegram user ID and the payment confirmation, never payment details; for the daily leaderboard we also read your Telegram first name (section 1.2). If you turned on reminders, our bot sends them through Telegram; because our server cannot reach Telegram directly, each message (your Telegram user ID and the short reminder text) passes through a Cloudflare function on this website on its way to Telegram. The same way, when you claim the channel reward, your Telegram user ID goes to Telegram to ask whether you are a member of our channel, and when you share your daily result or an invite as a picture message, your Telegram user ID, the share text and the picture's address go to Telegram so that it can prepare that message for you to send. Share pictures show only the challenge number and your result (no name or ID) and are not stored on our server (Telegram Privacy Policy).

We may also disclose information if required by law, to protect the rights and safety of our players or the service, or as part of a transfer of the game to a new operator, who would have to follow this policy.

7. Hosting and where data is processed

The website is served by Cloudflare's global network, so your connection is handled by a Cloudflare data center near you. Our game server and database are run by the Harbor Escape team on our own server, which is reachable only through a private Cloudflare connection and is not exposed directly to the internet. The text of feedback you send is also processed by DeepSeek in the People's Republic of China (section 1.4). Your data may therefore be processed in a country other than your own.

8. How long we keep data

Data	Retention
Gameplay events	Deleted automatically after 180 days.
Player and device records, cloud save, level completion records, rewarded ad records, Google account link	Kept while you play and until you ask us to delete them, or until the game is shut down.
Platform account name (section 1.2)	Kept together with your player data and deleted when it is.
Recovery codes	Valid for 24 hours; deleted within 7 days after they expire.
Feedback (including any email address you left and the AI analysis results)	Deleted automatically 365 days after it was sent, or earlier if you ask us. Daily AI reports contain no contact details or player IDs and are kept for as long as they are useful for improving the game. What DeepSeek keeps is governed by its own policy (section 1.4).
Server request logs	Written to size-limited logs (at most about 30 MB per server component) that are overwritten automatically as new requests arrive. How long an entry survives depends on traffic; we do not archive these logs or include them in backups.
Purchase records (Telegram Stars)	Kept while the game runs and for as long as accounting and tax rules require. If you ask us to delete your data, we delete what the purchases gave your player and keep only the purchase record itself, no longer linked to your player, because we need it for refunds and our accounts.
Telegram bot reminders	Your reminder settings are kept while reminders are on, and for 180 days after you turn them off (so the game does not ask you again); the record of each reminder sent is deleted after 180 days. All of it is deleted earlier if you ask us to delete your data.
Database backups	Made daily and kept for 14 days. Data you have asked us to delete disappears from backups when those backups expire.
Data in your browser	Until you clear this site's data in your browser.

9. Security

• All connections to the game and our server use HTTPS encryption.
• Our server is not directly reachable from the internet; it accepts traffic only through a private, encrypted Cloudflare tunnel.
• Requests are authenticated with signed tokens and rate-limited to prevent abuse. Google ID tokens are verified against Google's public keys and then discarded.
• Access to the server, database and backups is limited to the Harbor Escape team.
• We collect as little as possible: no names or passwords are stored on our server, and an email address only if you choose to leave one with feedback. The key for the AI service is stored encrypted, and contact details are removed before feedback is sent to it.

No method of transmission or storage is completely secure, but we work to protect your data and will act promptly if a problem occurs.

10. Your choices and rights

You can play without signing in, decline to watch ads, turn off personalised ads in Google's settings, and clear the game's data from your browser at any time.

Depending on where you live, you may have the right to access the data we hold about you, correct it, delete it, receive a copy of it, or object to or restrict how we use it. You can exercise any of these rights, whatever your country, by emailing us. You can also complain to your local data protection authority.

How to request access or deletion

Because we do not store your name or email address, we need a way to find your data:

1. In the game, open Settings → Get recovery code. The code identifies your progress and is valid for 24 hours. (If you lost your device but linked Google, sign in with Google on any device first, then get the code.)
2. Email the code to [email protected] and tell us what you want: a copy of your data, a correction, unlinking your Google account, or deleting all your data.
3. We reply and complete your request within 30 days. Deleting your data removes your player and device records (including how you found the game), cloud save, level completion records, rewarded ad records, gameplay events, feedback, daily challenge results, friends, leaderboard name, platform account name, reminder settings and Google account link from our database, as well as anything your purchases gave you; records of purchases made with Telegram Stars are kept without the link to your player (section 8). Copies in backups are deleted when those backups expire (at most 14 days later).
4. To also remove data from your device, clear this site's data in your browser.

If you cannot get a recovery code, email us anyway and we will help as far as we can. If you left an email address with feedback, you can also write to us from that address to have that feedback deleted.

11. Children

Harbor Escape is a general-audience game and is not directed at children under 13. We do not knowingly collect personal information from children under 13 (or the minimum age required in your country). If you believe a child has provided us with personal information, please contact us and we will delete it.

12. Changes to this policy

We may update this policy when the game changes. We will change the date at the top of this page, and for significant changes we will also tell players in the game or on this website before the change takes effect.

13. Contact

The Harbor Escape team
Email: [email protected]
Website: https://play.harb.fun/about